
Honorable Richard L. Thornburgh 
Attorney General 
Washington, D.C. 20530 

Dear Dick: 

Shortly after the Internet computer virus attack, which was 
first detected on November 2, 1988, we formed an executive after 
action assessment team within the Department of Defense. The 
team met on November 14, 1988, and reviewed the events and 
actions taken after detection of the virus on ARPANET and 
MILNET; reviewed the report by the National Computer Security 
Center titled "Proceedings of the Virus Post-Mortem Meeting, 
November 8, 1988," (Enclosure 1); reviewed the DARPA report on 
the technical characteristics of the virus (Enclosure 2); and 
concluded with recommendations for improving the Department's 
responsiveness to future attacks. 

As you will see from the team's report to me (Enclosure 3), 
the two areas on which we need to focus are the development of a 
central, national level coordination center, and increased 
computer security awareness. It became quickly evident during 
their analysis that the actions that need to be taken in the 
unclassified domain should be addressed jointly by the National 
Computer Security Center (NCSC) and the National Institute of 
Standards and Technology (NIST), with technical coordination 
from the Defense Advanced Research Projects Agency. There will 
clearly be a need for significant involvement from Justice and 
the FBI in determining what investigative and legislative 
guidelines should be put in place with the coordination center. 

I have requested that each of the Defense Components 
involved in the after action assessment support the 
recommendations on a priority basis. I solicit your personal 
support for this effort so that we can move rapidly to improve 
our national posture to deal with potential computer security 
problems in the future. 


Sincerely, 
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Enclosures: 
As Stated 
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